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(54) Controller for a machine with control of overwriting program or data in controller after 
machine stop 



(57) An engine, control program is not overwritten 
when an engine of a vehicle is in operation even if a 
memory writer (14) sends an engine write request (W) 
to an engine controller (2). When an operator stops the 
engine and the memory writer (14) again requests to 
overwrite the engine control program, the engine con- 
troller (2) receives a write control program from the 



memory writer (14) and executes the same. After that, 
the engine controller (2) starts a new engine control pro- 
gram after its CPU (8) Is reset. Therefore, since the en- 
gine is at a stop during the overwriting of the engine con- 
trol program, there will be no unexpected operations in 
the mechanism of the vehicle even though the control 
program and data are changed. 
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Description 

The present invention relates to controlling a ma- 
chine. An embodiment ot the invention described here- 
inafter relates to overwriting a program or data into a 
nonvolatile memory of a machine controller. In particu- 
lar, the embodiment relates to ovenwriting a built-in pro- 
gram or data for controlling an automative engine. 

A program of an engine controller for controlling an 
automotive engine may be overwritten with different 
control programs to test engine performance, tune the 
engine or the like. 

Conventionally, overwriting of the program of the 
engine controller is executed by connecting a program 
writer to the engine controller and coordinating the proc- 
esses of the engine controller and the program writer. 

That is, immediately after being reset, a CPU of the 
engine controller checks a signal of a mode determina- 
tion control signal line generated by the program writer. 
If the signal does not indicate a program write mode, a 
built-in control program is activated and engine control 
starts. If the signal of the mode determination control 
signal line indicates the program write mode, the built- 
in control program is not activated and the engine con- 
troller reads a new control program transmitted by the 
program writer and the contents of such new control pro- 
gram are overwritten on the built-in control program, and 
subsequently the new control program is started. 

For example, when the control program is to be 
overwritten, the overwriting process of such program is 
carried out immediately after resetting of the CPU of the 
engine controller to enable switching to the write mode 
to overwrite the control program when the same cannot 
be executed properly due to an abnormal operation (for 
example, disconnection of electric power) during the 
writing process. 

Japanese Patent Application LaidOpen No. Hei 
6-272611 discloses an engine controller which does 
away with the requirement for overwriting the control 
program before executing the same. 

When there is a serial communication interruption 
(SCI) from the program writer, the engine controller fol- 
lows a predetermined sequence, and thus, the control 
program can be overwritten even during the control pro- 
gram execution. Furthermore, the overwriting can be 
carried out while the engine itself is in operation. 

In the foregoing device, since control data set cor- 
responding to the condition of the engine remains in the 
RAM temporarily even when the control program is 
overwritten while the engine is In operation, the data can 
be copied back after overwriting so that the engine can 
be driven steadily. 

However, overwriting of the control program means 
a sudden shift to a control procedure different from the 
one being executed before such overwriting. When the 
engine is being driven during such overwriting, the driv- 
ing condition of each automotive mechanism driven by 
the engine may change suddenly which may make the 



driver uncomfortable. 

Thls kind of problem occurs not only for engine con- 
trol but also, for example, for brake control, transmission 
control, suspension control and the like in which the driv- 
5 ing condition may suddenly change when the control 
program and the control data are overwritten. 

In view of the foregoing problems in the prior art, an 
embodiment of the present Invention seeks to provide 
a machine controller whose built-in control program and 
10 control data can be overAwrltten without causing unex- 
pected operating conditions such as sudden changes in 
its operation and in a machine it is controlling, and con- 
trol malfunctions and the like when the built-in program 
and the built-in data are ovenA^ritten while the machine 
is is being driven. 

A first aspect of the present invention provides a 
machine controller for controlling operation of a machine 
following a built-in program. This machine controller in- 
cludes a write command detecting unit for detecting an 

20 external write command, an operating condition detect- 
ing unit for detecting an operating condition of the ma- 
chine which corresponds to inoperativeness of the ma- 
chine and a writing unit for overwriting an externally sup- 
plied control program on the built-in program based on 

2S the external write command detected by the write com- 
mand detecting unit and the operating condition detect- 
ed by the operating condition detecting unit. Therefore, 
overwriting of the built-in program is performed based 
on the detected write command and the detected oper- 

30 atlng condition of the machine. 

Preferably, the writing unit overwrites the control 
program on the built-in program only when the write 
command detecting unit detects input of the external 
write command and the operating condition detecting 

3S unit detects that the machine is at a stop. In this way, 
the built-in program and data are overwritten only when 
the write command is received and the machine is at a 
stop. Thus, the built-in program and data are not over- 
written when the machine is in operation and so there 

40 will be no unexpected operations in the machine that will 
make an operator of the machine feel uneasy. 

Preferably, the machine controller further includes 
a reporting unit for reporting the operation condition of 
the machine in a human recognizable manner In this 

45 way, the operator of the machine will know when to stop 
the machine when performing the ovenwrlting of the 
built-in program. 

Preferably, the machine controller further includes 
a terminating unit for terminating the operation of the 

50 machine. In this way, there is no need for the operator 
to stop the operation of the machine because this task 
is done automatically by the terminating unit and so, ef- 
ficiency of overwriting the built-in program improves. 
Preferably, the terminating unit gradually termi- 

5S nates the operation of the machine. For example, the 
machine can be stopped after reducing the engine ro- 
tational speed down to an idling state. In this way. dura- 
bilities of the machine and mechanisms driven by the 
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machine are prolonged and the operator will not feel un- 
easy unlike in the case when the machine is abruptly 
terminated. 

Preferiably, the machine controller includes a mem- 
ory unit for storing an overwriting routine which is used 
by the writing unit for overwriting the control program on 
the built-in program. The overwriting routine is not over- 
written, when the writing unit is overwriting the built-in 
prograrp and so; the overwriting of the control program 
can be performed smoothly The memory unit can be a 
RAM unit or a programmable ROM unit. 

Preferably, the machine is a vehicle and the built-in 
program is for controlling the vehicle. In this way, the 
machine controller can overwrite the built-in program for 
controlling the vehicle. 

Another aspect of the present invention provides a 
program writing method of the machine controller which 
includes the steps of detecting an external write com- 
mand, detecting a stop of the machine, and overwriting 
an externally supplied control program on the built-in 
program only when the external write command is de- 
tected and the stop is detected. 

A better understanding of the present invention will 
be more readily apparent from the following detailed de- 
scription of illustrative embodiments thereof when taken 
together with the accompanying drawings in which: 

, FIG:. 1 is a block diagram of an entire construction 
of an engine controller according to a first embodi- 
ment of the present invention; 

> FIG. 2 is an explanatory view of a memory region 
of a CPU of the engine controller; 

. FIG. 3 is a flowchart of a boot program, an engine 
control program and a write control program ac- 
cording to the first embodiment; 
FIG. 4 is a flowchart of an engine control routine 
according to the first embodiment; 
FIG. 5 is aflowchart of an engine stall determination 
process according to the first embodiment; 
FIG. 6A is a flowchart of a process for incrementing 
a time counter CENST; 

FIG. 6B is a flowchart of an engine rotational speed 
pulse input interruption process lor resetting the 
time counter CENST; 

FIG. 7 is a flowchart of an interruption process for 
setting a flash ROM writing request flag XWRITE; 
and 

FIG. 8 is a flowchart illustrating the txjot program, 
the engine control program and the write control 
program according to a second embodiment of the 
present invention. 

FIG. 1 is a block diagram illustrating an overall con- 
struction of an engine controller 2 according to a first 
embodiment of the present invention. FIG. 1 shows the 
engine controller 2 which is installed in a vehicle and 
which controls an internal combustion engine. The en- 
gine includes a variety of sensors 4 for indicating an'op- 
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ei-ating condition with signals from these sensors 4 be- 
ing provided to the engine controller 2. The engine con- 
troller 2 includes an input processor 6 for processing the 
signals from the sensors 4, a CPU 8 for calculating an 
5 optimal operating condition of the engine based on the 
processed sensor signals, an output circuit 12 for receiv- 
ing calculation results of the CPU 8 as control signals 
for driving actuators 1 0 of a fuel injection unit, an ignition 
unit and the like which are installed on the engine, and 

10 ^ a communication circuit 1 6 for performing data commu- 
nication with a memory writer 14 which is outside of the 
engine controller 2. The memory writer 14 may be cou- 
pled to the engine controller 2 when tuning or testing 
engine characteristics. 

IS the CPU 8 includes an MPU (microprocessor unit) 
18 which operates by following a control program, a 
ROM 20 for storing a program and data needed for mak- 
ing the MPU 18 operate, a RAM 22 for storing calcula- 
tion results of the MPU 1 8, and an I/O (input-output un it) 

20 24 for receiving signals from the input processor 6 and 
the communication circuit 16, and generating control 
signals to the output circuit 12. It must be noted here 
that an erasable flash EEPROM (electrically erasable 
programmable read-only memory which is commonly 

2S known as flash ROM or flash memory) 20a which allows"" 
deletion of all data stored therein is used in one part of "' 
the ROM 20. A nonerasable ROM 20b is provided at 
another portion of the ROM 20. The flash EEPROM and"" 
the EEPROM may be used for the nonerasable ROM* * 

30 20b as long as deletion and overwriting operations ther- 
eon are prohibited. 

The memory writer 14 and the engine controller 
are connected with each other such that signals can be'^ 
transmitted between them via a bus connection connec-' 

35 tor 26 when tuning or testing the engine. A communica- 
tion bus line 28 connected to the bus connection con- 
nector 26 enables transmission of data between the 
CPU 8 and the merrrary writer 1 4 based on a serial trans- 
mission function. Moreover, as will be described later, a 

40 mode determination control signal line 30 connected to 
the memory writer 14 via the bus connection connector 
26 enables the memory writer 14 to set the operating 
mode of the CPU 8 after the CPU 8 is reset. 

Under a predetermined condition, a part of the pro- 
gram and data received by the CPU 8 via the commu- 
nication bus line 28 are stored in the RAM 22 as program 
and data tor execution. Other portions of the received 
program and data are stored in the programmable EEP- 
ROM 20a in replacement of other program and data sl\- 

so ready stored therein. 

FIG. 2 illustrates memory regions of the ROM 20 
and the RAM 22. The flash EEPROM 20a is provided 
with an engine control program and data storage area 
32 in which the appropriate control program and control 

55 data are already stored. That is, control program and 
. control data stored in the engine control program and 
data storage area 32 are stored as the built-in program 
and the built-in data. 
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A boot program storage area 34 which stores the 
appropriate boot program is provided in the nonerasable 
ROM 20b. A flash ROM write control program storage 
area 36 and a computation area 38 are provided in the 
RAM 22. The flash ROM write control program received 
from the meriKiry writer 14 is stored in the flash ROM 
write control program storage area 36 under a predeter- 
mined condition and the computation area 38 is used 
for calculation operations during the execution of the 
flash ROM write control program. 

Normally, the engine control program and data stor- 
age area 32 contains engine control program and en- 
gine control data while the boot program storage area 
34 contains a boot program. Immediately after resetting, 
the CPU 8 activates the boot program which has a reset 
entry address and executes engine control by calling the 
engine control program from the boot program. 

FIG. 3 illustrates a flowchart of the boot program 
and the engine control program. 

After resetting the CPUS, execution of the boot pro- 
gram in the nonerasable ROM 20b is started and step 
100 checks the mode determination control signal to de- 
termine the type of control mode based on the mode 
determination control signal of the mode determination 
control signal line 30. If step 100 determines that the 
mode determination control signal indicates an engine 
control mode, control goes to step 200 which enables 
jumping to the engine control program. As a result, con- 
trol goes to the engine control program stored in the 
flash EE PROM 20a and step 300 executes an engine 
control routine based the engine control data. 

The engine control routine may be, for example, like 
the routine shown by the flowchart of FIG. 4. In this rou- 
tine, step 110 executes an engine stall determination 
process, step 120 executes an engine rotation speed 
calculation process, step 130 involves sensor input 
processing, step 140 executes a target fuel injection 
amount calculation process, step 1 50 executes a target 
fuel injection time calculation process, step 160 exe- 
cutes a target fuel injection pressure calculation proc- 
ess, step 170 executes an actuator control pulse output 
process and step 180 executes various self -diagnostic 
processes. 

The engine stall determination process of step 110 
determines an engine stall when the pulse signal gen- 
erated in correspondence with a rotational speed of the 
engine by a rotational speed sensor provided in the en- 
gine is not detected by the CPU 8 for more than a pre- 
determined time period X. The engine stall determina- 
tion process of step 110 is illustrated in a flowchart of 
FIG. 5. 

In this engine stall determination process, step 112 
determines a value of a time counter CENST which in- 
dicates the elapsed time since the latest pulse signal. If 
the value of the time counter CENST is no less than the 
predetermined time period X, step 112 determines there 
is an engine stall and step 114 sets an engine stall flag 
XENST If the value of the CENST is less than the pre- 



determined time period X, step 116 resets the engine 
stall flag XENST 

The time counter CENST is shown in the flowcharts 
of FIGS. 6A and 6B. In the flowchart of FIG. 6A which 
s is a periodic interruption process, step 117 increments 
the time counter CENST at a predetermined period. In 
an engine rotation speed pulse input interruption proc- 
ess of FIG. 6B, step 1 1 8 resets the time counter CENST 
every time the engine rotational speed pulse is received. 

10 Therefore, unless the engine rotational speed pulse is 
received by the CPU 8, the time counter CENST grad- 
ually increases and its value indicates the amount of 
time the engine rotational speed pulse has not been de- 
tected. In the engine rotation frequency pulse interrup- 

^5 tion process of FIG. 6B, at the same time, step 119 ex- 
ecutes a pulse width measurement process for calcu- 
lating the engine rotational speed based on the intervals 
between the engine rotational speed pulses. 

Going back to the flowchart shown in FIG. 3, after 

20 the engine control routine of step 300 and before it is 
executed again, step 400 determines whether or not a 
flash ROM write request has been received based on a 
flash ROM write request flag XWRITE. 

The flash ROM write request flag XWRITE is set in 

2S the SCI process which is carried out when serial signals 
are received from the memory writer 1 4 connected to 
the engine controller 2 via the communication bus line 
28. That is, when the CPU 8 receives serial signals from 
the memory writer 14. the SCI process shown in FIG. 7 

30 is carried out wherein step 201 0 determines whether or 
not a flash ROM write request signal W has been re- 
ceived from the memory writer 14. If step 2010 deter- 
mines that the flash ROM write request signal *W has 
been received, step 2020 sets the flash ROM write re- 

35 quest flag XWRITE. This process terminates if step 
2010 gives a negative output. 

Going back to the flowchart of FIG. 3, step 400 
checks if the flash ROM write request flag XWRITE is 
set every time the engine control routine of step 300 is 

^o executed. If the flash write request flag XWRITE is not 
set, then step 300 again executes the engine control 
routine. 

When the flash ROM write request flag XWRITE is 
set, step 500 resets the same. Step 600 determines 

45 whether or not the engine is at a stop by checking the 
engine stall flag XENST processed in the engine stall 
determination process shown in FIG. 5. If the engine 
stall flag XENST is reset, then the engine is determined 
to be in operation and step 700 sets a reply code 

50 TRANS, which is sent to the memory writer 14 via the 
communication bus line 28, to an engine stop request 
code 'P and step 300 repeats the execution of the en- 
gine control routine. 

The engine stop request code 'F' set in the reply 

55 code TRANS is transmitted to the memory writer 14 via 
the communication bus line 28 by a transmission inter- 
ruption process (not shown in the figure) of the CPU 8. 
Upon receipt of the engine stop request code *F', the 
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memory writer 1 4 displays on its monitor the engine stop 
request code 'F' or comments indicating the contents 
thereof. 

Therefore, the engine controller 2 makes a request 
. to an operator of the vehicle to stop the engine. Thus, s 
even though the memory writer 14 generates the flash 
ROM write request W, the CPU 8 does not go to the 
flash ROM write process (step 900 and subsequent 
steps) unless the engine is stopped. Thus, the engine 
continues to be controlled by the present control pro- 
gram and control data. 

Next, when the operator stops the engine and the 
memory writer 14 again generates the flash ROM write 
request signal 'W, because the engine stall flag XENST 
is set following the termination of the engine, step 800 
sets the flash ROM write mode allowance code 'W as 
the reply code TRANS. Next, step 900 downloads the 
flash ROM write control program from the memory writer 
14 to the RAM 22 of the CPU 8. 

That is, upon receipt of the flash ROM write mode 20 
allowance code 'W, the memory writer 1 4 generates the 
flash ROM write control program stored in a memory 
medium coupled to it such as ROM, RAM, a magnetic 
disk or the like to the engine controller 2 via the comrriu- 
nication bus line 28 based on a predetermined hand- 2S 
shaking procedure. In step 900, the CPU 8 receives the 
flash ROM write control program and stores it in the flash 
ROM write control program storage area 36 of the RAM 
22. 

After receiving the flash ROM write control program, 30 
step 1 000 jumps to the start address of the flash ROM 
write control program storage area 36 and starts the 
flash ROM write control program. 

The flash ROM write control program of step 2000 
overwrites a part or the entire portion of the program and 35 
data of the engine control program and data storage ar- 
ea 32 of the flash EEPROM 20a following the steps enu- 
merated below. 

First, the start address of the target memory area 
to be overwritten (or deleted) is read from the memory 
writer 1 4 via the communication bus line 28 and the tar- 
get memory area to be overwritten (or deleted) is 
cleared. 

Then, new program and data are read from the 
memory writer 1 4 via the communication bus line 28 and ^5 
are written in the memory region in the flash EEPROM 
20a which was cleared off the previous program and da- 
ta. 

The CPU 8 receives all programs and data needed 
foroverwritingfromthememory writer 14andgenerates 50 
write completion signals to the memory writer 1 4 via the 
communication bus line 28 upon completion of overwrit- 
ing the flash EEPROM 20a. Then, control goes to an 
Infinite loop which repeatedly generates the write com- 
pletion signals. 

After receiving the write completion signals, the 
memory writer 1 4 displays a write completion message, 
on its monitor. Accordingly, when the operator sets the 



mode determination control signal line 30 to the engine 
control mode and resets the CPU 8. because writing on 
the boot program storage^ area 34 Is prohibited, the 
same boot program is again started and thus, first of all, 
step 100 checks the mode determinatbn control signal. 
Since the mode determination coritrol. signal from the 
memory writer 14 indicates the engine control mode, 
step 200 starts the engine control program stored in the 
engine control program and data storage area 32 of the 
flash EEPROM 20a. 

As described above, a part or the whole portion of 
the engine control program and the control data used in 
the engine control program are overwritten. Therefore, 
the engine control routine of step 300 executes a type 
of engine control differerit from the control program be- 
fore overwriting. At this point, since the engine is at a 
stop, there will be no unusual operations in the mecha- 
nism of the vehicle as in conventional devices. 

Since steps 400 to 800 are not overwritten in the 
present embodiment, the function of jumping from the 
engine control to overwriting the engine control program 
and data storage area remains intact. Of course, such 
a function remains intact if the same contents are written 
for steps 400 to 800. Moreover, steps 400 to 800 can be . 
overwritten to implement better routines. 

Furthernr>ore, steps 400 through 800 may be placed 
in the nonerasable ROM 20b in the same way as the 
boot program instead of being placed in the engine con- 
trol program and storage area 32. In this case, the new 
control program may be set to call steps 400 to 800 eve- 
ry time it is executed. In addition, steps 400 to 800 may 
also be in a region of the same engine control program 
and storage area 32 provided that overwriting in such a 
region which is done in step 2000 is prohibited. In both 
of the above-described cases, the functions of steps 
400-800 remain intact. 

In the present embodiment, since the writing of the 
engine control program and control data are not execut- 
ed unless the engine is at a stop, abnormalities in the 
operating conditions of the vehicle due to the switching 
of the control program and the control data while the en- 
gine is in operation will not occur. Thus, the operator will 
not feel uneasy. 

Moreover, after overwriting the control program and 
data and resetting the GPU 8. since the CPU 8 starts 
operations from the boot program in the boot program 
storage area 34 and not from step 300, there will be no 
program abnormalities such as those that occur when 
control goes to an empty engine control program and 
data storage area 32 after the overwriting procedure of 
step 2000 fails with the previous control program and 
control data already erased from the same storage area 
32. 

A second embodiment of the present invention is 
described hereinafter. 

The process of the second embodiment is shown 
by the flowchart of FIG. 8. Explanation of constructions 
and processes similar to those of the first embodiment 
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are omitted here. The process of FIG. 8 differs from the 
process of FIG. 3 in that steps 720 and 740 are executed 
here instead of step 700 after step 600 determines that 
the engine is in operation when the engine stall flag 
XENST is not set. 

In order to notify the memory writer 14 of the com- 
pulsory stoppage of the engine, step 720 sets the reply 
code TRANS to the engine compulsory stop code 'C. 
As a result, the engine compulsory stoppage command 
is transmitted to the memory writer 14 via the comrnu- 
nication bus line 28, Therefore, after receiving the en- 
gine compulsory stop code *CV the memory writer 1 4 dis- 
plays on its monitor the automatic stoppage of the en- 
gine to inform the operator 

Step 740 stops the engine by setting the target fuel 
injection amount to zero, stopping the electric power 
supply to an ignition unit or the like. 

With the operation of the engine stopped in this way, 
there will be no need to return to step 300 and thus, con- 
trol goes to the process of step 900 after step 740. In 
the same way as the first embodiment, control goes to 
the overwriting process of the program and data inside 
the engine control program and data storage area 32. 

Since the engine is automatically stopped when the 
engine control program and control data are to be over- 
written, the engine control program and control data are 
not overwritten while the engine is in operation. There- 
fore, since there is no switching to a different control pro- 
gram while the engine is in operation, there will be no 
abnormalities in the operating condition of the vehicle 
which nnay make the operator feel uneasy. The present 
embodiment gives the same effects as that of the first 
embodiment. 

Although the present invention has been fully de- 
scribed in connection with preferred embodiments 
thereof with reference to the accompanying drawings, it 
is to be noted that various changes and modifications 
will become apparent to those skilled in the art. 

In each of the above-described embodiments, step 
2000 enters an infinite loop for repeatedly generating 
the overwriting completion signals to the memory writer 
1 4 after the completion of overwriting the engine control 
program and data. However, the CPU 8 may be reset 
after the completion of the overwriting. Furthermore, 
control may go to the process of step 300 after step 2000 
without resetting the CPU 8 so that engine control based 
on the hew program and data can be started. In this 
case, problems in the vehicle will not occur since the 
engine is not in operation. 

Also, while the engine is stopped in step 740 of the 
second embodiment immediately after step 720 informs 
the memory writer 14 of the engine compulsory stop- 
page, the engine may also be stopped after making a 
lamp or the like of the engine controller 2 flash to give 
notice of the engine stoppage without informing the 
memory writer 14. 

In the second embodiment, since a malfunction in 
the engine occurs and the operator feels uneasy when 



the engine stops suddenly, the engine rotational speed 
may be reduced first to an idling state and thereafter the 
engine can be stopped. Moreover, the engine may be 
stopped after maintaining the rotation of the engine for 
s a time period it takes the operator to realize the compul- 
sory stoppage of the engine after step 720 informs the 
memory writer 14 of the engine compulsory stoppage. 

Also, when the engine is to be stopped automatical- 
ly, step 720 may request the memory writer 14 for per- 
10 mission to execute the compulsory stoppage of the en- 
gine and execute step 740 when the memory writer 14 
sends a code from the operator for permitting the engine 
stoppage. When the operator sends the code for not al- 
lowing the engine stoppage, the engine is not stopped. 
IS control returns to step 300 and the overwriting process 
of the program and data is disabled. 

In each of the above-described embodiments, step 
100 checks the mode determination control signal from 
the mode determination control signal line 30 after re- 
setting the CPU 8 and control goes to the write process 
after step 1 00 determines that the CPU 8 is in the flash 
ROM write mode. However, the fact that control can go 
to the same write process with a write connmand from 
the memory writer 1 4 in the engine control mode renders 
step 100 unnecessary. Therefore, the engine control 
program control data can be overwritten with no need 
for providing the mode determination control signal line 
30. 

Therefore, conventional tools such as a diagnostic 
reader, which reads diagnostic data from the engine 
controller 2 and the iike via a normal communication bus 
connector that has no mode determination control signal 
line 30. can be used by incorporating the functions of 
the memory writer 14 into such tools and so, conven- 
tional tools can be used without any need for special 
equipment. 

While each of the embodiment deals with overwrit- 
ing the engine control program and data, the present 
invention need not be limited to such and may be used 
in other various applications. For example, the present 
invention can be used for brake control, transmission 
control, suspension control and the like wherein a whole 
portion or a part of a brake mechanism, transmission 
mechanism, suspension mechanism is driven by the op- 
eration of the engine. In other words, when overwriting 
the control program and data for executing brake con- 
trol, transmission control or the like under such a circum- 
stance, unexpected changes in the operating condition 
which makes the operator feel uneasy and control prob- 
lems due to failure to write the control program might 
occur. 

Therefore, in the same way as the first and second 
embodiments described above, while the engine is in 
operation and there is a command to overwrite the brake 
control program, transmission control program, suspen- 
sion control program or the like, there will be no unex- 
pected operations in the mechanisms driven by the en- 
gine since the engine is stopped manually or automati- 
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cally after notifying the operator. 

Further, when overwriting the brake control pro- 
grann. transmission control program, suspension control 
program or the engine control program as in the case ot 
the above-described embodiments, the overwriting of 
the control program and data may be allowed not only 
after determining whether the engine is rotating or not 
but also after determining whether the vehicle is in op- , 
eration or not. That is, ovenwriting of the control program 
is allowed when rl is determined that the vehicle is not 
in operation. Also, it may also be that overwriting of the 
control program and data is allowed when the gear of 
the vehicle is a neutral position. 

In each of the above-described embodiments, al- 
though the flash ROM write control program is executed 
after the same Is received from the memory writer 1 4 
and stored In the flash ROf^ writing control program 
storage area 36 of the RAM 22, the same program may 
also be provided in the nonerasable ROM 20b, so that 
there Is no need to download the same from the memory 
writer 14. 

The boot program provided in the nonerasable 
ROM 20b is executed at the start of the resetting of the 
CPU 8. This prevents malfunctions in the CPU 8 by as- 
suring that there will bo no jumps to a region In which 
nothing is written after overwriting of the engine control 
program fails. Further, in the jumping process of step 
200 to the engine control program, when the same step 
200 determines that nothing is written in a jump desti- 
nation, such jump is stopped and an error code is gen- 
erated to the memory writer 14 to notify the operator of 
the error. 

By the way, It should be noted here that the control- 
ler 2 may be provided with a monitor which displays the 
operating condition of the machine being controlled. 

Meanwhile, while overwriting an existing control 
program has been discussed here, it must also be noted 
that the present invention can also be used for writing 
an initial control program. 

Such changes and modifications are to be under- 
stood as being within the scope of the present Invention 
as defined by the appended claims. 
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program based on said external write com- 
mand detected by said write command detect- 
ing means (400) and said operating condition 
detected by said operating condition detecting 
means (600). 

A machine controller (2) according to claim 1, 
wherein: 

said writing means (2000) is for overwriting 
said control program on said built-in program only 
when said write command detecting means (400) 
detects input of said external write command and 
said operating condition detecting means (600) de- 
tects said operating condition which indicates that 
said machine is at a stop. 



3. A machine controller (2) according to claim 1 or 
claim 2 further comprising reporting means for re- 
porting in a human recognizable manner about said 

20 ^ operating condition of said machine, wherein: 

said reporting means is for reporting that said 
machine Is at a stop and said writing means (2000) 
is for overwriting said control program on said built- 
in program only when said write comrnand detecting 

25 means (400) detects Input of said external write 
command and said operating condition detecting 
means (600) detects said operating condition which 
indicates that said machine is at a stop. 

30 4. A machine controller (2) according to any one of 
claims 1 to 3 further comprising temninating means 
(740) for terminating said operation of said ma-" 
chine, wherein: 

said writing means (2000) is for overwriting 

35 said control program on said built-in program only 
when said write command detecting means (400) ' 
detects input of said external write command and 
said operating condition detecting means (600) de- 
tects said operating condition which indicates that 

40 said machine is at a stop after said terminating 
means (740) terminates said operation of said ma- 
chine. 



Claims 



A machine controller (2) for controlling operation of 
a machine following a built-in program and control 
data, said machine controller (2) comprising: 

write command detecting means (400) for de- 
tecting an external write command; 
operating condition detecting means (600) for 
detecting an operating condition of said ma- 
chine predetermined to correspond to substan- 
tial inoperativeness of said machine; and 
writing means (2000) for overwriting an exter- 
nally supplied control program on said built-in 



5. A machine controller (2) according to claim 4. 
45 wherein: 

said terminating means (740) is for gradually 
terminating said operation of said machine. 

6. A machine controller (2) according to any one of 
50 claims 1 to 5, wherein: 

said writing means (2000) is for overwriting 
said control program said built-in program when a 
predetermined time elapses after said operating 
condition detecting means (600) detects said oper- 
as ating condition which Indicates that said machine is 
at a stop. 

7. A machine controller (2) according to any one of 
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claims 1 to 6 further comprising a merrvDry unit for 
storing an overwriting routine which remains intact 
when said writing means (2000) overwrites on said 
buitt-in program, wherein: 

said writing means (2000) is for overwriting s 
said control program on said built-in program follow- 
ing said ovenwriting routine. 

8. A machine controller (2) according to any one of 
claims 1 to 7 further comprising a booting means to 
(200) for activating said built-in program. 

9. A machine controller (2) according to any one of 
claims 1 to 8, wherein: 

said machine Is a vehicle and said built-in pro- is 
gram is for controlling said vehicle. 

10. A machine controller (2) according to claim 9, 
wherein: 

said built-in program is for controlling an en- 20 
gine of said vehicle, 

11. A machine controller (2) according to claim 10, 
wherein: 

said operating condition detecting means 
(600) is for detecting rotation of said engine of said 
vehicle. 

12. A machine controller (2) according to any one of 
claims 1 to 11 further comprising a programmable 
ROM unit (20a) for storing said built-in program. 

13. A machine controller (2) according to any one of 
claims 1 to 12, wherein said writing means (2000) 

is further for overwriting said control data. 3S 

14. A method of controlling a machine following a built- 
in program, said method comprising the steps of: 

detectirig (400) an external write command; 4o 
detecting (600) a stop of said machine; and 
overwriting (2000) an externally supplied con- 
trol program on said built-in program only when 
said external write command is detected and 
said stop is delected. -^5 

15. A method according to claim 14 additionally com- 
prising the step of: 

reporting on said stop of said machine in a hu- 
man recognizable manner after detecting (600) said 50 
stop of said machine. 

16. A method according to claim 15 additionally com- 
prising the step of: 

stopping (740) operation of said machine after ss 
detecting (400) said external write command and 
before reporting on said stop. 



17. A method according to claim 14 additionally com- 
prising the step of: 

stopping (740) operation of said machine after 
detecting (400) said external write command. 

18. A method according to claim 16 or claim 17, where- 
in: 

said stopping step (740) is for gradually stop- 
ping said operation of said machine. 



^^MXJCID: <EP_0762249A1J_> 



8 



EP 0 762 249 A1 



SENSOR 
SENSOR 
SENSOR 
SENSOR 



F/G. 1 



r 



INR 



8 



12 





20 



16: COMMU 




EEPROM 



20a 22 



OUT 



ROM ^ 



RAM 



20b 



Acm 



>10 



ACTUA. 



*__0762249A 1 J_> 



9 



EP 0 762 249 A1 



FIG. 2 



32 — 



ENGINE CONTROL 
PROGRAM. DATA 
STORAGE AREA 



, FLASH 
) EEPROM 

20a 



RESET 
ENTRY 
ADDRESS 



34 — 



BOOT PROGRAM 
STORAGE AREA 



ROM 20b 



36 -+ aASH ROM WRITE 
CONTROL PROGRAM 
STORAGE AREA 



38 — 



COMPIJTATION AREA 



1 



RAM 22 



10 



EP 0 762 249 A1 



FIG. 3 



-BOOT PROGRAM 
1 iSTQRED LN_R0M_20I) ) 



( START ) 

100 

JYPE CONTROL^ 
MODE?. 




FLASH ROM 
WRITE MODE 



900 



LOAD FLASH ROM 
WRITE PROGRAM 
TO RAM 



i ^1000 



JUMP TO FLASH 
ROM WRITE 
CONTROL PROGRAM 



— — — ^ 



2000 



WRITE ENGINE 
CONTROL PROGRAM 
ON aASH ROM 



^ FLASH ROM WRITE 
CONTROL PROGRAM 
(STORED IN RAM 22) 



'-ENGINE CONTROL PROGRAM 
(STORED IN EEPROM 203) 



SDOCIO: <EP 07e2249Al J_> 



11 



1 ' 

EP 0 762 249 A1 



FIG. 4 



( START ) 

1 



DETERMINE 
ENGINE STALL 



/ 



110 



GET ENGINE 
ROTATION SPEED 



/ 



GET SENS OR INPUTS 
■ 



GET TARGET 
INJECTIO N AMOUNT 



GET TARGET 
INJECTION TIMING 



GET TARGET 
INJECTION PRESSURE 
■ — 



120 

130 
140 

150 

160 



OUTPUT ACTUA. 
CONTROL PULSE 

I 



170 



diagnosis 
(end) 



V 
pi 80 



FIG. 7 

( START ) 

--L^ _^2010 
- RECEIVED ^CT Kin 
FLASH ROM 
WRITE SIGNAL'W?^^ 




SET XWRITE ^ 



12 

>0OCIC>: <EP ^0762249A1 J_> 



EP 0 762 249 A1 



FIG. 5 



( START ) 



CENST^X?. 



NO 



( END ) 



SET XENST 




RESET XENST 




1 



FIG. 6A 

( START ) 



( START ) 



INCREMENT 




CENST 





RESET CENST K 



118 



GET PULSE wiSnTK 

(end) 



■11 



13 



EP 0 762 249 Al 



FIG. 8 



PROGRAM 
' (STORED IN ROM 20 b) 



( START 0 

-100 

JVPE'DFCONTRa^. 
MODE?. 



FLASH ROM 
WRITE MODE 



ENGINE 
CONTROL MODE 



200 



JUMP TO ENGINE 
CONTROL PROGRAM 



300 



ENGINE CONTROL 
ROUTINE 




XWRITE SETJ 
YES f 500 



RESET XWRITE 



720 



XENST SET?, 



YES 



TRANS *-'C* I 
74 0>^ I '^^J_^800 

STOP ENGINE I I TRANS*-'W' 

— I — — r~ z 



900 



LOAD FLASH ROM 
WRITE PROGRAM 
TO RAM 



1000 



JUMP TO PUSH 
ROM WRITE 
CONTROL PROGRAM 



2000 



WRITE ENGINE 
CONTRa PROGRAM 
ON FLASH ROM 



-FLASH ROM WRITE 
CONTROL PROGRAM 
(STORED IN RAM 22) 



'^ENGINE CONTROL PROGRAM 
(STORED IN EEPROM 20a) 



EP 0 762 249 A1 



European Patent 
Office 



EUROPEAN SEARCH REPORT 



Appltc&lien Number 

EP 96 30 5568 



DOCUMENTS CONSIDERED TO BE RELEVANT 



Category 



CttaCion of docufDc&t with indicadou, where appropruce, 
of relevant pasxaeey 



Rcjevanc 
to cbini 



CljlSSIFlCAnON OF THE 
APPUCATION (liit.CL&) 



EP-A-G 455 174 (BAYERISCHE MOTOREN WERKE 
AG) 6 November 1991 

* claims 1,3 * 

EP-A-0 323 211 (HOMDA) 5 July 1989 

* claim 1 * 

DE-A-38 24 754 {TOKAIKOGYO MI5HIN) 2 
February 1989 

* claim 8 * 

US-A-5 293 317 (ADRAIN JOHN B ET AL) 8 
March 1994 

* the whole document * 



U2.7-14 



1,2,7-14 



3,4,16, 
17 



U14 



G05B 19/408 



TECHNICAL FIELDS 
SEARCHED ani.a.6) 



G05B 



The pr cscf i t search fvport tias been drawn up for all daJins 



8 
3 

I 

i 



MUNICH 



22 November 1996 



Messelken, M 



CATEGOKY OF CITED DOCUMENTS 

X : partjcntuty relevant if taJten alose 

y : particDlarty rdevsnt tf coiabineri mth aootbcr 

iocumcot of tbe same catceor>- 
A : lechnotoKical bacfc^rouDd 
O ; RoQ-wrincn disclosure 
P : intenneiitate document 



T : theory or pnoctple andcrlying tbe inventioa 
E : earlier patent docmnent, but published on, or 

after the ftliog date 
O : docaracnt dted tn tbe appUcatioQ 
L : dooiisent died for other reasons 



& : rnenber of tbe same patent family-, cnrrrspnadtng 
document 



iOOCtO: <EP_Q7eZ249A1_l_> 



15 



niSPABi BLANK 



mpTO) 



